Multi-Photon Entanglement Concentration and Quantum Cryptography 
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Multi-photon states from parametric down-conversion can be entangled both in polarization and 
photon number. Maximal high-dimensional entanglement can be concentrated post-selectively from 
these states via photon counting. This makes them natural candidates for quantum key distribution, 
where the presence of more than one photon per detection interval has up to now been considered 
as undesirable. We propose a simple multi-photon cryptography protocol for the case of low losses. 
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Parametric down-conversion is a convenient way of cre- 
ating entangled states of light Q| . So far it has been ex- 
plored in two separate regimes. Experiments on the few- 
photon level have often relied on polarization entangle- 
ment , while experiments with macroscopic amounts of 
light have observed two-mode squeezing, that is entangle- 
ment in photon number |^]. It is however possible to build 
sources that combine both kinds of entanglement. The 
basic principle has recently been demonstrated . Such 
a source can be seen as a pair of phase-coherent two-mode 
squeezers. We will show that from this point of view 
photon counting can be used as a post-selective realiza- 
tion of entanglement concentration for continuous vari- 
able states. Maximal high-dimensional entanglement can 
be extracted in this way from the multi-photon states. 

It is natural to consider the application of this entan- 
glement for quantum key distribution. For the original 
quantum cryptography protocols || |(| the presence of 
more than one photon in a single pulse or detection in- 
terval is a problem for security. Therefore implementa- 
tions of key distribution are usually restricted to weak 
transmission signals, with a low probability of containing 
even a single photon, limiting the achievable bit rate per 
pulse. The pulse rate itself is mainly limited by the dead 
time of the photon detectors. Here we take a more pos- 
itive approach to multi-photon states in cryptography. 
We ask whether they can be used to improve the capac- 
ity of the secure channel. We propose a simple protocol 
which leads to a significant increase in bit rates for the 
case of low losses. 

We will first describe our proposed post-selective re- 
alization of entanglement concentration for continuous- 
variable states. Entanglement concentration is a proce- 
dure that allows two parties Alice and Bob to extract 
maximal entanglement from non-maximally entangled 
pure states using only local operations and classical com- 
munication Consider the (un- normalized) two-mode 
squeezed state 
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For later convenience, we have assumed that the photons 
in the spatial mode a (going to Alice) are horizontally 
and those in mode b (going to Bob) are vertically polar- 
ized. This state represents photon-number entanglement 
between modes and b v , that is, a quantum superposi- 
tion of different states for which the number of photons 
in mode ah and b v are the same. The state is however not 
maximally entangled since A is always smaller than unity 
and therefore the individual terms in the superposition 
have different weights. 

Based on ref. we describe a way to concentrate 
photon- number entanglement. Suppose that in addition 
to (Q) Alice and Bob are also given the state \ip2) — 
J2m=o(~^) m \ m )aJ m )b h , which differs from (Q) by the 
sign of the squeezing parameter and by the polarization 
of the photons in modes a and b. The total state is then 
given by: 



i*) = mm = E E x ' +m (- i r\i)a h \m) a jm) bh \i) b , 
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Defining n 



rearranging terms and using the 



short-hand notation \u,v;w,x) for 
yields 
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where A is usually referred to as the squeezing parameter. 



where we have collected the terms with the same number 
of photons n received by Alice and Bob. 

Entanglement concentration could now be achieved by 
performing a projection measurement onto a specific pho- 
ton number. For a given n, this results in a superposition 
state of n + 1 equally weighted terms. It is evident from 
(0) that each term satisfies (N v — Nh) a — (Nh — N v )b- 
From our subsequent discussion it will become clear that 
these perfect correlations in photon number difference 
exist not only in the h/v polarization basis, but in any 
basis. This is a consequence of the maximal entangle- 
ment in (|3|), i.e. of the fixed phase relations between the 
different \(n — to), to; to, (n — m)) terms. 
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At first glance, the above scheme seems to require 
a quantum non-demolition (QND) measurement of the 
photon number on each side in order to project onto 
a fixed value of n = (N v + N h ) a = (N v + N h ) b with- 
out losing the possibility of measuring (N v — Nh) a an d 
(Nh — N v )t, afterwards. Ways of realizing such a QND 
measurement were discussed in Q , but it is very difficult 
to implement. On the other hand, destructive photon 
counting is feasible. It is therefore important to real- 
ize that for many applications it is not strictly necessary 
to perform the n projection before the (N v — Nh) a and 
(Nh — N v )b measurements. They can be performed si- 
multaneously by simply measuring (N v ) a , {N h ) a , {N h ) b 
and (Nh)b independently. The basis of polarization anal- 
ysis can be varied, permitting the observation of perfect 
correlations in more than one basis. This approach is 
similar to the post-selection strategy that enabled the 
demonstration of quantum teleportation (hJ and related 
single-photon experiments. 

Clearly one should be careful in referring to a post- 
selection method as a concentration scheme since no con- 
centrated output state is obtained. However, for the pur- 
pose of quantum cryptography the post-selection method 
will suffice, since it allows to establish perfect correlations 
between Alice's and Bob's measurement results. 

In quantum key distribution, to prevent eavesdropping 
it is essential that perfect correlations are obtained in at 
least two complementary bases. If there were perfect cor- 
relations only in one basis, the eavesdropper could make 
her measurements in this basis, and the process would 
not be secure. We now show that, due to our specific 
choice of relative phases, the state (||) is symmetric under 
a joint rotation of polarisation bases through equal an- 
gles in modes 'a' and 'b'. Therefore, the state exhibits the 
same photon-number difference correlations in, for exam- 
ple, the linear polarization basis rotated by 45°. We also 
show how such a symmetric state (^|) can be generated in 
a natural way using type-II parametric down-conversion. 

Parametric down-conversion is a process where a pho- 
ton from a pump light source can be split into two pho- 
tons of lower frequency within a non-linear optical crys- 
tal. One can experimentally achieve conditions where a 
good approximation for the relevant interaction Hamil- 
tonian is 



H = K(a]fil - alb\) + h.c, 



(4) 



where the complex number k is the product of the am- 
plitude of the pump beam and the relevant non-linear 
coefficient of the crystal. This is the familiar Hamilto- 
nian for the creation of polarization entangled photon 
pairs Q , which has been the basis for many experiments 
in quantum information. Using the normal ordering the- 
orem of (ll|] one can show that this Hamiltonian leads to 
the production of entangled photon states of the follow- 



ing form: 

\ip) = exp(-iHt/h)\Q) 
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cosh (r) ^ 
where r = ^ is the effective interaction time and 
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The total state (H) has exactly the form of state @). 
The terms {ip™}, which correspond to n photons on each 
side, are maximally entangled states shared between Al- 
ice and Bob in a Hilbert space of (n + 1) x (n + 1) di- 
mensions. Similar states were studied in the context of 
Bell's inequalities in They are all invariant under 

joint identical polarization transformations by Alice and 
Bob, since they are created by the application to the vac- 
uum of powers of the operator (a^Sj — aj&j^), whose form 
is conserved under such transformations. These proper- 
ties make them generalized singlet states, which moti- 
vates our notation \ip 7 l). Whenever Alice has (n — m) 
photons polarized along a certain direction and to pho- 
tons polarized along the orthogonal one, Bob has m and 
(n — to) photons of the respective polarizations. When 
employed for quantum key distribution, every pair of val- 
ues (to, n — to) constitutes a letter in the cryptographical 
alphabet. 

A simple key distribution protocol using the multi- 
photon states proceeds in the following way. From a 
common source, entangled multi-photon pulses are sent 
to Alice and Bob via modes a and b. Alice and Bob each 
independently and randomly choose one of two comple- 
mentary bases, h/v and h'/v', in which to perform their 
photon number measurements. Here, the primed basis 
is rotated by 45° with respect to the unprimed basis. 
These measurements act as a post-selective multi-photon 
entanglement concentration resulting in detected corre- 
lations associated with the states where n is the 
number of detected photons on each side. They commu- 
nicate their basis choice via classical means and extract 
the key from the photon number difference recorded in 
those cases where they had chosen the same basis. Fi- 
nally, Alice and Bob examine a randomly chosen part of 
the key for errors. In the ideal case any amount of errors 
indicates the presence of an eavesdropper. 

It is clear that in the absence of losses the achievable 
bit rate increases significantly with the number of pho- 
tons because the number of distinguishable measurement 
outcomes increases. There are n + 1 different possible 
measurement results for the state For protocols 

based on the multi-photon states photon losses in- 

troduce errors because the state after losses no longer has 
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the perfect correlations expected. We will model photon 
losses by the action of beam-splitters introduced to each 
of the four modes (ah,a v ,bh,b v ). The probabilities for 
the measurement of particular photon numbers in each 
mode can be calculated using a positive operator valued 
measure (POVM). The operator associated with a mea- 
surement of 'n' photons in mode (behind the beam- 
splitter) is 

m=0 

Here, r\ is the transmission coefficient of the beam- 
splitter, and corresponds to the overall quantum effi- 
ciency of the system, including lossy lines and imperfect 
detectors. Each term in (Q) corresponds to a certain num- 
ber of photons m that were lost. We assume the same 
amount of loss in all four photon modes. Probabilities 
of specific outcomes are calculated by taking the expec- 
tation value of the associated POVMs with the down- 
conversion state Eq.(||). Thus the probabilities are func- 
tions only of r\ and r. 

The information shared between Alice and Bob can be 
quantified by the mutual information [jTJj : 

_ Ea,bP(^». B^^pjAj , Bj ) 
AB ~ EiP(Ai)log2p(Ai) Y.iP{Bi)log2p{B t ) ' ( ' 

which is a function of the joint probabilities for Alice's 
and Bob's measurement results, denoted by Ai and Bj 
respectively. An outcome labelled Ai corresponds to a 
particular pair of photon-numbers measurement made on 
Alice's side; it will be of form (n— fc) photons in mode ah 
{ah'), and k photons in mode a v (ov), where the basis of 
polarization analysis depends on her choice. 

In quantum cryptography, Alice and Bob have to as- 
sume that all errors that seem to be due to losses could 
actually be the consequence of eavesdropping, with the 
eavesdropper Eve simulating the effect of lossy lines. In 
such a situation, Eve will have some knowledge about 
Alice's and Bob's results, quantified by the mutual infor- 
mations Iae,Ibe- In the presence of an eavesdropper, 
the number of secure shared bits that Alice and Bob can 
distill by privacy amplification techniques [ fL4| is denoted 
the 'secrecy capacity' C s , and is limited by the inequality 

C s > Iab - mm(I AE ,lBE)- (9) 



Determining the achievable secure bit rates in principle 
requires an analysis of all possible eavesdropping strate- 
gies. This is a difficult task in the present situation since 
the system under consideration is very complex. In this 
paper, as a first step, we consider a specific key distri- 
bution protocol where Alice and Bob make use of the 
4-photon detection results (each detects 2 photons) in 
addition to the 2-photon results (each detects 1 photon). 
We have compared this case to the standard protocol 
which exclusively uses the 2-photon results Q]. As for 
the eavesdropping strategy, we suppose that Eve's tech- 
nology is so powerful that she can replace the lossy trans- 
mission lines, unknown to Alice and Bob, by ideal ones. 
Furthermore, we assume that Eve controls the source. 
She is aware that Alice and Bob will monitor errors, and 
tailors her interference to reproduce the error profiles ex- 
pected. Indeed, there are two types of errors that Alice 
and Bob can check. 

The first type is the occurrence of photon number de- 
tections different from one on each side or two on each 
side. These results are produced under normal circum- 
stances, despite not being used for key generation. Eve 
has no choice but to replicate these signals, labelled be- 
low in Eq.(|l(]) as p TCSt . 

The second type of error occurs when Alice and Bob 
both measure the same number of photons, but not the 
ideal perfect correlations in polarization. Eve sends 2- 
photon and 4-photon signals with the expected overall 
probabilities, Pi 1(77, r), P2. 2(^7, t), but does not always 
send the singlet states, ^2)1 which give her no in- 

formation, and give Alice and Bob perfect correlations. 
Instead, a proportion of the time defined by 7, Eve sends 
a product state with the correct correlations in one ba- 
sis. She has no way of knowing the basis, © (h/v) or ® 
(h'/v') in which the legitimate users will measure, and is 
forced to choose randomly. If she guesses correctly, she 
has full knowledge of their results. However, when her 
basis choice differs from that of Alice and Bob, she in- 
troduces correlation errors on their measurements. The 
percentage 7 is constrained to produce exactly the fre- 
quency of natural errors expected on the 2- and 4-photon 
signals. Therefore it is also a function of r\ and r. The 
state produced by Eve's source is: 

PEve = Pl.lPl.l + P2, 2/02,2 + (1 ~ Pl,l ~ P2,2)/3rest (10) 

where for instance: 



pi ll = (l-7)^r)<^rl + f(|1.0;0,l) 8 (l J 0;0 J l| + |0,l;l, 0)®<0, 1; 1, 0| + |1, 0; 0, l) e (l,0; 0, 1| + |0, 1; 1, 0) e (0, 1; 1,0|) 

(11) 
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The subscripts ©, ® label the two complementary polar- 
isation bases in which each product state is defined. The 
state ^2,2 is defined analogously. From an explicit de- 
scription of the full state as given above one can directly 
calculate the joint probabilities for all possible measure- 
ment outcomes, which determine each mutual informa- 
tion and thus the minimum secrecy capacity. 
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FIG. 1: The minimum achievable secure bit rate C { s m[n) Eq. 
(^) for the multi-photon protocol is depicted in (a) upper 
graph, in the context of the specific eavesdropping attack 
mentioned in the text. To contrast, the equivalent measure for 
the standard protocol, using 2-photon results only, is shown 
in (a), lower graph. Graphs are plotted in terms of the over- 
all transmission 77, and the effective interaction time of the 
source r, cf. eq. (g). One sees that using 4-photon detections 
in addition leads to a significant increase in secure bit rates 
in the region of low losses. This is shown in more detail in 
(b) where we have plotted cl mm ' for both protocols, at their 
optimal r values; r = 0.78 and r = 0.70 for the multipho- 
ton and standard protocols respectively. ci mln ^ decreases for 
higher r values, as can be seen clearly in (a), because the 
probabilities for 2-photon and 4-photon results are reduced 
as higher photon numbers become more likely. 

The results are shown in figure 0. One sees that for 
a comparatively low level of losses the minimum secrecy 
capacity is approximately doubled by using the 4-photon 
states in addition. This effect would be increased sub- 
stantially by including higher photon numbers. 

It should be noted in this context that efficient multi- 



photon detectors JlfJ and optical fibres with very low 
losses jlTj are both under development. Currently, losses 
and limited detection efficiencies are serious practical re- 
strictions. One can see from fig. |l|(b) that for the present 
protocol the advantage of using the higher photon num- 
ber states disappears for overall losses that exceed 35 %. 
However, there is some indication that the multi-photon 
states may still be viable candidates for quantum key 
distribution for higher losses. The entanglement in the 
states \tpn) 1S quite robust under photon loss. We will 
address this topic in a future publication. The entangle- 
ment that remains after some loss could be purified and 
then used for key distribution or other quantum commu- 
nication tasks. 

Natural applications for multi-photon entanglement in- 
clude all-optical quantum error correction ||18| and even 
all-optical quantum computation [ [l9| . The use of down- 
conversion multi-photon states for these purposes is a 
topic for future research. 
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